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Independent Orbiter Assessment 

Analysis of the Ascent Thrust Vector Control Actuator Subsystem 


1 . 0 EXECUTIVE SUMMARY 

The McDonnell Douglas Astronautics Company (MDAC) was selected in 
June 1986 to perform an Independent Orbiter Assessment (IOA) of 
the Failure Modes and Effects Analysis (FMEA) and Critical Items 
List (CIL). Direction was given by the STS Orbiter and GFE 
Projects Office to perform the hardware analysis using the 
instructions and ground rules defined in NSTS 22206 , Instructions 
for Preparation of FMEA and CIL, 10 October 1986 . The IOA 
approach features a top-down analysis of the hardware to 
determine failure modes, criticality, and potential critical 
items. To preserve independence, this analysis was accomplished 
without reliance upon the results contained within the NASA 
FMEA /CIL documentation. This report documents (Appendix C) the 
independent analysis results for the Ascent Thrust Vector Control 
(ATVC) Actuator hardware. 

The function of the Ascent Thrust Vector Control Actuators (ATVC) 
is to gimbal the main engines to provide for attitude and flight 
path control during ascent. During first stage flight, the SRB 
nozzles provide nearly all the steering. After SRB separation, 
the Orbiter is steered by gimbaling of its main engines. There 
are six electrohydraulic servoactuators, one pitch and one yaw 
for each of the three main engines. 

Each servoactuator is composed of four electrohydraulic 
servovalve assemblies, one second stage power spool valve 
assembly, one primary piston assembly and a switching valve. 

The IOA analysis process utilized available hardware drawings 
and schematics for defining hardware -assemblies , components , and 
hardware items. Each level of hardware was evaluated and 
analyzed for possible failure modes and effects. Criticality was 
assigned based upon the severity of the effect for each failure 
mode. 

Figures 1 and 2 presents a summary of the failure criticalities 
for each of the major elements of the Main Engine Servoactuator. 

A summary of the number of failure modes, by criticality, is also 
presented below with Hardware (H) criticality first and 
Functional (F) criticality second. 


+ + 

I Summary of IOA Failure Modes By Criticality (HW/F) I 


Criticality : 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

3/3 

TOTAL 

Number : 

L. 

9 

7 

- 

1 

- 

9 

26 
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ATVC ACTUATOR 
ANALYSIS SUMMARY 



Figure 1 - ATVC ELECTROHYDRAULIC SERVOACTUATOR SUMMARY 
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Figure 2 - TYPICAL ACTUATOR ASSEMBLY 
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For each failure mode identified, the criticality and redundancy 
screens were examined to identify critical items. A summary of 
Potential Critical Items (PCIs) is presented as follows: 


+ 

| Summary of IOA Potential Critical Items (HW/F) 


Criticality: 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

TOTAL 

Number : 

9 

7 

- 

- 

- 

16 


Critical failures resulting in loss of ATVC were mainly 
due to loss of hydraulic fluid, fluid contamination and 
mechanical failures. 
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2.0 


INTRODUCTION 


2.1 Purpose 

The 51-L Challenger accident prompted the NASA to readdress 
safety policies, concepts, and rationale being used in the 
National Space Transportation System (NSTS). The NSTS Office has 
undertaken the task of reevaluating the FMEA/CIL for the Space 
Shuttle design. The MDAC is providing an independent assessment 
of the Orbiter FMEA/CIL for completeness and technical accuracy. 


2.2 Scope 

The scope of the independent FMEA/CIL assessment activity 
encompasses those Shuttle Orbiter subsystems and GFE hardware 
identified in the Space Shuttle Independent FMEA/CIL Assessment 
Contractor Statement of Work. Each subsystem analysis addresses 
hardware, functions, internal and external interfaces, and 
operational requirements for all mission phases. 


2.3 Analysis Approach 

The independent analysis approach is a top-down analysis 
utilizing as-built drawings to breakdown the respective subsystem 
into components and low-level hardware items . Each hardware item 
is evaluated for failure mode, effects, and criticality. These 
data are documented in the respective subsystem analysis report, 
and are used to assess the NASA and Prime Contractor FMEA/CIL 
reevaluation results. The IOA analysis approach is summarized in 
the following Steps 1.0 through 3.0. Step 4.0 summarizes the 
assessment of the NASA and Prime Contractor FMEAs/CILs that is 
performed and documented at a later date. 


Step. 1.0 Subsystem Familiarization 

1.1 Define subsystem functions 

1 . 2 Define subsystem components 

1 . 3 Define subsystem specific ground rules and 
assumptions 

Step 2.0 Define subsystem analysis diagram 

2.1 Define subsystem 

2.2 Define major assemblies 

2.3 Develop detailed subsystem representations 

Step 3.0 Failure events definition 

3 . 1 Construct matrix of failure modes 

3.2 Document IOA analysis results 



Step 4.0 Compare IOA analysis data to NASA FMEA/CIL 

4.1 Resolve differences 

4.2 Review in-house 

4.3 Document assessment issues 

4.4 Forward findings to Project Manager 


2.4 ATVC Actuator Ground Rules and Assumptions 


The ATVC Actuator definitions, ground rules, and assumptions used 
in the IOA are defined in Appendix B.l and B.2. There were no 
subsystem specific ground rules and assumptions used in the 
analysis. 
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3 . 0 SUBSYSTEM DESCRIPTION 

3.1 Design and Function 

The ATVC servoactuators gimbal the main engines in pitch and yaw 
to provide for attitude and flight path control during ascent. 
There are two Ascent Thrust Vector Control (ATVC) actuators for 
each ME, one for pitch movement and one for yaw movement. Each 
actuator receives four command voltages, one from each ATVC 
driver electronics channel. Each actuator employs two of the 
three Orbiter hydraulic systems (one primary and one secondary). 
Each METVC servoactuator consists of the following components: 

1. Switching valve. Two Orbiter hydraulic systems are 
connected to the valve. The output from the valve connects 
to four servovalves and to a power spool. The valve will 
shift position when the hydraulic pressure of the 
controlling system is less than 1200 to 1500 psi and will 
furnish standby pressure to the actuator. 

2. Four electro-hydraulic servovalves. Each servovalve 
consists of a second-stage valve, a torque motor assembly 
with power valve feedback wire, a mechanical position 
feedback spring cage assembly, a bypass valve, a dynamic 
pressure feedback valve, and a secondary delta pressure 
transducer. The function of the servovalve is to generate 
secondary hydraulic pressure to drive a power spool valve in 
response to position commands from the ATVC electronic 
driver. 

3. Torque motor assembly. The assembly consists of dual 
magnets, a flapper valve and two feedback wires attached to 
the flapper; one wire is linked to the servovalve and the 
other is linked to the power spool valve. The wires are 
used to control the spool velocity. When a command voltage 

* generates a torque, it causes the flapper to rotate in a 
clockwise or counterclockwise direction causing a pressure 
buildup in either the right or left sections of the 
servovalve, thus moving the valve to the right or left. 

When the valve is displaced, the hydraulic pressure is 
transferred to the power spool which then transfers 
hydraulic pressure to the primary drive piston. 

4. Mechanical position feedback assembly. The assembly links 
each of the four torque motor flappers to the primary 
piston. The assembly allows the flapper to rotate initially 
in response to a command voltage input, and then 
mechanically moves the flapper back to its neutral position 
as the primary piston reaches its commanded position. 

5. Bypass valve. The bypass valve isolates a servovalve when a 
secondary delta pressure is determined to be bad by the 
ATVC electronics. When an isolation command is issued to a 
solenoid a piston shuttles against a spring. This allows 
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hydraulic pressure to shuttle a second piston which inhibits 
hydraulic flow from the servovalve to the power piston. 

This equalizes pressure on both sides of the hydraulic 
supply which allows the servovalve to float, thus isolating 
it from the system. 

6. Secondary delta pressure transducer. Each servovalve has a 
transducer which measures the resistance its servovalve sees 
relative to the other three servovalves. It sends signals 
to the ATVC electronics which determines which, if any, 
delta pressure is outside allowable limits. If a delta 
pressure fails , the TVC sends an isolation command to the 
bypass valve. 

7. Power spool valve assembly. Each actuator has one power 
spool which provides primary hydraulic pressure to the 
primary piston. The power spool consists of a cylinder that 
contains a linear power spool. The power spool has a 
central position whose motion is driven by the summation of 
the secondary delta pressure from the four servovalves. 

When the power spool is displaced, hydraulic fluid is 
directed through a lock valve to the primary piston. The 
lock valve hydraulically isolates the cylinder and primary 
piston from the hydraulic source to prevent further movement 
of the primary piston. If there is a hydraulic failure, the 
lock valve spool moves (due to spring pressure) to a closed 
position which locks the primary piston in its last 
commanded position. A force limiter valve limits internal 
cylinder pressure to 4050 psi. (The valve was used during 
the OFT program to determine side loads during main engine 
gimbaling. ) The valve is functionally non-critical. 
Instrumentation has been removed from the Orbiter. 

8. Cylinder and ram/piston assembly. The assembly produces 
linear motion (extend or retract) to move the SSME in pitch 
and mechanical position feedback cam and a feedback scissor 
assembly which connects to the mechanical position feedback 
spring cage assembly. The main cylinder reservoirs receive 
hydraulic pressure or return the Orbiter hydraulic supply 
through the feed/return lines leading to the power valve via 
the lock valve. As the ram moves, the scissor assembly 
contracts or expands, pushing the mechanical linkage (up or 
down) which moves the torque motor flapper. When the 
piston/cam reaches its commanded position, the feedback 
assembly removes secondary fluid pressures to the power 
valve. 


3.2 Interfaces and Locations 

The ATVC servoactuators interface with the four ATVC electronics 
drivers which receive commands via four MDMs from the four GPCs . 
Crew initiated command inputs are through the GPCs. The crew can 
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turn power on or off to any ATVC channel and place a FCS channel 
in ORIDE which bypasses the ATVC fault detection circuitry. 

Each actuator is fastended to the Orbiter thrust structures and 
to the powerhead of one of the three SSMEs. 

Crew inputs fall into three areas, rotational hand controller 
(RHC) commands, override commands and ATVC power. 

The FA MDMs and the ATVC electronic drives are located in 
Avionics Bays 4 , 5 and 6 . 

FCS channel monitor switches are located on Panel C3 . The ATVC 
power switches are located on Panel 017 . 

The two displays relative to MPS ATVC are the caution and warning 
(C&W) matrix (Panel F7) and the GNC System Summary 1 display. 

The GNC System Summary 1 display (PASS and BFS ) shows a down 
arrow for an FCS channel that has isolated a failed servovalve 
and a fault message. 


3 . 3 Hierarchy 

Figure 3 is a block diagram of the ATVC servo actuators. Figures 
4 through 8 show components which were analyzed for failure 
modes . 
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Figure 3 - ATVC SERVOACTUATOR BLOCK DIAGRAM 


10 


MECHANICS. POSiTJO/4 FD8K 









W 

1 OC 1 X 


< wt u* < 
a. ae x 3C 


Figure 4 - SWITCHING VALVE 
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Figure 5 - ELECTROHYDRAULIC SERVOVALVE ASSEMBLY 
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4 . 0 ANALYSIS RESULTS 


Detailed analysis results for each of the identified failure 
inodes are presented in Appendix C. Table I presents a summary of 
the failure criticalities. 


| TABLE I Summary of IOA Failure Modes 

and Criticalities 

Criticality: 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

3/3 

TOTAL 

0 Servo- 
Actuator 
Hydraulic 
Valve Module 

2 

1 





3 

EH Servovalve 

- 

4 

- 

- 

- 

- 

4 

Filter 

1 

- 

- 

- 

- 

1 

2 

Bypass Valve 
Secondary 
Delta P 




1 


1 

2 

Transducer 
Power Spool 

— 

1 





1 

Valve 

1 

- 

- 

- 

- 

- 

1 

Check Valve 

1 

- 

- 

- 

- 

1 

2 

Lock Valve 
Force Limiter 

2 

— 

— 


— 

— 

2 

Valve 

Dynamic Press. 



” 

— 


2 

2 

Feedback Valve 

- 

- 

- 


- 

2 

2 

Switch Valve 
Flow Cutoff 
Primary Piston 
Assembly 


1 





1 

Valve 

Mechanical 





‘ 

2 

2 

Pos . Feedback 
Cylinder and 
Ram/Piston 

1 






1 

Assembly 

1 






1 

TOTAL 

9 

7 

- 

1 

- 

9 

26 

+ 


Critical failures which cause loss of the servoactuator were due 
to loss of hydraulic fluid, gross and slow leaks, valve failures 
due to contamination, clogged filters, loss of hydraulic 
pressure, mechanical failures in servovalves and its mechanical 
feedback mechanism and inability to detect failures by the ATVC 
fault detection circuitry. 
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Of the 26 failure modes analyzed, 16 failures were determined to 
be Potential Critical Items (PCIs). A summary of the PCIs is 
presented in Table II. Appendix D presents a cross reference 
between each PCI and a specific worksheet in Appendix C. 


TABLE II Summary of IOA Potential Critical Items 


Criticality: 

1/1 

2/1R 

2/2 

3/1R 

3/2R 

TOTAL 

0 Servo- 

Actuator 

2 

1 


. 


3 

Hydraulic 
Valve Module 
EH Servovalve 


4 




4 

Filter 

1 

- 

- 

- 

— 

i 

Secondary 
Delta P 
Transducer 


1 




i 

Power Spool 
Valve 

1 

_ 

__ 



_ 

i 

Check Valve 

1 

- 

- 

- 

- 

i 

Lock Valve 

2 

- 

- 

- 


2 

Switch Valve 

- 

1 

- 

- 


1 

Primary Piston 
Assembly 
Mechanical 
Pos . Feedback 

1 





1 

Cylinder and 

Ram/Piston 

Assembly 

1 

- 

- 

- 

- 

1 

TOTAL 

f — 

9 

7 

- 

- 

- 

16 


4.1 Analysis Results - Servoactuator 

Failures which were related to the Servoactuators as an entity 
were first analyzed. Critical failures were due to loss of 
hydraulic fluid, gross and slow leaks. 

4.2 Analysis Results - Hydraulic Valve Module 

Components were individually analyzed. Most critical failures of 
these components included loss of command signal input, valve 
failure due to contamination, clogged filters and loss of 
hydraulic pressure. 
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4.3 Analysis Results - Primary Piston Assembly 

Critical failures were due to mechanical failures ( fractures and 
j ammed components ) . 
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APPENDIX A 
ACRONYMS 



AT VC 

— 

Ascent Thrust Vector Control 

— 

BFS 

- 

Backup Flight System 


C&W 

- 

Caution and Warning 


CIL 

- 

Critical Items List 


CRT 

- 

Cathode Ray Tube 


delta P 

— 

Differential Pressure 


E-H Servo VLV 

- 

Electro-Hydraulic Servovalve 

i : 

F 

- 

Functional 

— * 

FCS 

- 

Flight Control System 


FMEA 

- 

Failure Modes Effect Analysis 

- 

GNC 

- 

Guidance Navigation and Control 

-- - 

GPC 

- 

General Purpose Computer 


HW 

- 

Hardware 


IOA 

- 

Independent Orbiter Assessment 

m :-i 

MDAC 

- 

McDonnell Douglas Astronautics Company 

Mi 

MDM 

- 

Multiplexer /Demultiplexer 


METVC 

- 

Main Engine Thrust Vector Control 

P 

ORIDE 

- 

Override 

mm 

PASS 

- 

Primary Avionics Software System 


RI 

- 

Rockwell International 

=^ ; 

RHC 

— 

Rotational Hand Controller 


SSME 

- 

Space Shuttle Main Engine 

wm 

SRB 

- 

Solid Rocket Booster 


m 
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B.l Definitions 

B . 2 Project Level Ground Rules and Assumptions 
B.3 Subsystem-Specific Ground Rules and Assumptions 
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APPENDIX B 

DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B.l Definitions 

Definitions contained in NSTS 22206 , Instructions For Preparation 
of FMEA/CIL , 10 October 19 86 , were used with the following 
amplifications and additions. 

INTACT ABORT DEFINITIONS : 

RTLS - begins at transition to OPS 6 and ends at transition 
to OPS 9, post-flight 

TAL - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 

AOA - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 

ATO - begins at declaration of the abort and ends at 
transition to OPS 9, post-flight 

CREDIBLE (CAUSE) - an event that can be predicted or expected in 
anticipated operational environmental conditions. Excludes an 
event where multiple failures must first occur to result in 
environmental extremes 

CONTINGENCY CREW PROCEDURES - procedures that are utilized beyond 
the standard malfunction procedures, pocket checklists, and cue 
cards 

EARLY MISSION TERMINATION - termination of onorbit phase prior to 
planned end of mission 

EFFECTS /RATIONALE - description of the case which generated the 
highest criticality 

HIGHEST CRITICALITY - the highest functional criticality 
determined in the phase-by-phase analysis 

MAJOR MODE (MM) - major sub-mode of software operational sequence 
(OPS) 

MC - Memory Configuration of Primary Avionics Software System 
( PASS ) 

MISSION - assigned performance of a specific Orbiter flight with 
payload/obj ective accomplishments including orbit phasing and 
altitude (excludes secondary payloads such as GAS cans, 
middeck P/L, etc.) 
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MULTIPLE ORDER FAILURE - describes the failure due to a single 
cause or event of all units which perform a necessary (critical) 
function 

OFF-NOMINAL CREW PROCEDURES - procedures that are utilized beyond 
the standard malfunction procedures, pocket checklists, and cue 
cards 

OPS - software operational sequence 

PRIMARY MISSION OBJECTIVES - worst case primary mission objec- 
tives are equal to mission objectives 

PHASE DEFINITIONS : 

PRELAUNCH PHASE - begins at launch count-down Orbiter 
power-up and ends at moding to OPS Major Mode 102 (liftoff) 

LIFTOFF MISSION PHASE - begins at SRB ignition (MM 102) and 
ends at transition out of OPS 1 (Synonymous with ASCENT) 

ONORBIT PHASE - begins at transition to OPS 2 or OPS 8 and 
ends at transition out of OPS 2 or OPS 8 

DEORBIT PHASE - begins at transition to OPS Major Mode 
301 and ends at first main landing gear touchdown 

LANDING/SAFING PHASE - begins at first main gear 
touchdown and ends with the completion of post-landing 
safing operations 
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APPENDIX B 

DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 


B . 2 IOA Project Level Ground Rules and Assumptions 

The philosophy embodied in NSTS 22206, Instructions for 
Preparation of FMEA/CIL, 10 Oct oBer 1986 , was employed with the 
following amplifications and additions. 


1. The operational flight software is an accurate 
implementation of the Flight System Software Requirements 
( FSSRs ) . 

RATIONALE: Software verification is out-of-scope of 
this task. 

2. After liftoff, any parameter which is monitored by system 
management (SM) or which drives any part of the Caution and 
Warning System (CS.W) will support passage of Redundancy 
Screen B for its corresponding hardware item. 

RATIONALE: Analysis of on-board parameter availability 
and/or the actual monitoring by the crew 
is beyond the scope of this task. 

3. Any data employed with flight software is assumed to be 
functional for the specific vehicle and specific mission 
being flown. 

RATIONALE: Mission data verification is out-of-scope of 
this task. 

4. All ha'rdware (including firmware) is manufactured and 
assembled to the design specifications/drawings. 

RATIONALE: Acceptance and verification testing is 

designed to detect and identify problems 
before the item is approved for use. 

5. All Flight Data File crew procedures will be assumed 
performed as written, and will not include human error in 
their performance. 

RATIONALE: Failures caused by human operational error 
are out-of-scope of this task. 
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6. All hardware analyses will, as a minimum, be performed at 
the level of analysis existent within NASA/Prime Contractor 
Orbiter FMEA/CILs , and will be permitted to go to greater 
hardware detail levels but not lesser. 

RATIONALE: Comparison of IOA analysis results with 

other analyses requires that both analyses 
be performed to a comparable level of 
detail . 

7. verification that a telemetry parameter is actually 
monitored during AOS by ground-based personnel is not 
required . 

RATIONALE: Analysis of mission-dependent telemetry 

availability and/or the actual monitoring of 
applicable data by ground-based personnel is 
beyond the scope of this task. 

8. The determination of criticalities per phase is based on the 
worst case effect of a failure for the phase being analyzed. 
The failure can occur in the phase being analyzed or in 

any previous phase, whichever produces the worst case 
effects for the phase of interest. 

RATIONALE: Assigning phase criticalities ensures a 
thorough and complete analysis. 

9. Analysis of wire harnesses, cables and electrical connectors 
to determine if FMEAs are warranted will not be performed 
nor FMEAs assessed. 

RATIONALE: Analysis was substantially complete prior 

to NSTS 22206 ground rule redirection. 

10. Analysis of welds or brazed joints that cannot be inspected 
will not be performed nor FMEAs assessed . 

RATIONALE: Analysis was substantially complete prior 

to NSTS 22206 ground rule redirection. 

11. Emergency system or hardware will include burst discs and 
will exclude the EMU Secondary Oxygen Pack (SOP), pressure 
relief valves and the landing gear pyrotechnics. 

RATIONALE: Clarify definition of emergency systems to 
ensure consistency throughout IOA project. 


1:H 


B-5 



APPENDIX B 

DEFINITIONS, GROUND RULES, AND ASSUMPTIONS 

B.3 ATVC Actuator - Specific Ground Rules and Assumptions 
None . 
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APPENDIX C 
DETAILED ANALYSIS 


This section contains the IOA analysis worksheets generated 
during the analysis of this subsystem. The information on these 
worksheets is intentionally similar to the NASA FMEAs. Each of 
these sheets identifies the hardware item being analyzed, and 
parent assembly, as well as the function. For each failure mode, 
the possible causes are outlined, and the assessed hardware and 
functional criticality for each mission phase is listed, as 
described in the NSTS 22206, Instructions for; Prepa ration of FMEA 
and CIL, 10 October 1986. Finally, effects are entered at the 
Bottom of each sheet, and the worst case criticality is entered 
at the top. 


LEGEND FOR IOA ANALYSIS WORKSHEETS 


Hardware Criticalities: 

1 - Loss of life or vehicle 

2 - Loss of mission or next failure of any redundant item 

(like or unlike) could cause loss of life/vehicle 

3 - All others 

Functional Criticalities: 

1R - Redundant hardware items (like or unlike) all of which, 
if failed, could cause loss of life or vehicle. 

2R - Redundant hardware items (like or unlike) all of which, 
if failed, could cause loss of mission. 

Redundancy Screen A: 

1 - Is Checked Out PreFlight 

2 - Is Capable of Check Out PreFlight 

3 - Not Capable of Check Out PreFlight 
NA - Not Applicable 

Redundancy Screens B and C: 

P ■ Passed Screen 
F - Failed Screen 
NA - Not Applicable 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM : 
MDAC ID: 


10 / 02/86 
AT VC 
101 


HIGHEST CRITICALITY 
FLIGHT : 
ABORT: 


HDW/FUNC 

1/1 

1/1 


ITEM: METVC SERVO ACTUATOR (6) 

FAILURE MODE: COMPONENT RUPTURE DOWNSTREAM OF SWITCH VALVE 


LEAD ANALYST: R. WILSON SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) METVC SERVO ACTUATOR ( 2EA. ENGINE) 

2 ) 

3) 

4) 

5) 

6) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE HDW/FUNC ABORT 

PRELAUNCH: 3/3 RTLS : 

LIFTOFF: 1/1 TAL: 

ONORBIT: 3/3 AOA: 

DEORBIT: 1/1 ATO: 

LANDING/ SAFING: 3/3 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 

LOCATION: ORBITER THRUST STRUCTURE 

PART NUMBER: MC621-0015 


CAUSES: MATERIAL DEFECT, SERVO VALVE, DYNAMIC PRESSURE FEEDBACK 

ASS'Y, MANIFOLDS, FORCE LIMITER, CYLINDER ACTUATOR BODY 


EFFECTS /RATIONALE i 

ASCENT - THERE IS A LOSS OF TWO HYDRAULIC POWER SYSTEMS WHICH 
RESULTS IN LOSS OF CONTROL. THIS IS A SINGLE FAILURE POINT WHERE 
THERE IS NO REDUNDANCY FOR CYLINDER RUPTURE. 

ENTRY - ENGINES CAN NOT BE POSITIONED, WHICH RESULTS IN POSSIBLE 
ENGINE COLLISION, INTERFERENCES WITH BODY FLAP, OR CENTER ENGINE 
PROJECTS INTO AIRSTREAM - LOSS OF VEHICLE/CREW. 


REFERENCES : 


REPORT DATE 11/22/86 


C-2 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE : 

SUBSYSTEM : 
MDAC ID: 


10 / 02/86 
AT VC 
102 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: METVC SERVO ACTUATOR (6) 

FAILURE MODE: EXTERNAL LEAKAGE 


LEAD ANALYST: R. WILSON SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) METVC SERVO ACTUATOR ( 2EA. ENGINE) 

2 ) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 



CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF : 

1/1 

TAL: 

1/1 

ONORBIT : 

3/3 

AOA: 

1/1 

DEORBIT : 
LANDING/ SAFING 

1/1 

3/3 

ATO: 

1/1 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: ORBITER THRUST STRUCTURE 

PART NUMBER: MC621-0015 


CAUSES: LOSS OF PISTON ROD GLAND RETENTION IN BODY - LOSS OF 1 

OR 3 DYNAMIC PRESSURE FEEDBACK ASSEMBLY RETENTION SCREWS. 

EFFECTS /RATION AL E : 

ASCENT - POSSIBLE LOSS OF TWO HYDRAULIC SYSTEMS RESULTS IN LOSS 
OF CONTROL. 

DEORBIT - POSSIBLE LOSS OF TWO HYDRAULIC SYSTEMS TO ACTUATOR WHEN 
ISO VALVE OPENED FOR ENGINE REPOSITIONING PRIOR TO ENTRY WHICH 
MAY RESULT IN POSSIBLE ENGINE COLLISION AND POSSIBLE LOSS OF 
VEHICLE/CREW. 


REFERENCES : 


REPORT DATE 11/22/86 


C-3 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM : 
MDAC ID: 

ITEM: 

FAILURE MODE: 


10 / 02/86 
AT VC 
103 


HIGHEST CRITICALITY 
FLIGHT : 
ABORT: 


HDW/FUNC 

2/1R 

2/1R 


MET VC SERVO ACTUATOR (6) 
LEAKAGE 


LEAD ANALYST: R. WILSON 


SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) METVC SERVO ACTUATOR ( 2EA. ENGINE) 

2 ) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


HDW/FUNC 

ABORT 

HDW/FUNC 

3/3 

RTLS : 

2/1R 

2/1R 

TAL: 

2/1R 

3/3 

AOA: 

2/1R 

2/1R 

3/3 

ATO: 

2/1R 

A [ 3 ] 

B [ P ] 

C [ P ] 


FLIGHT PHASE 
PRELAUNCH: 

LIFTOFF: 

ONORBIT : 

DEORBIT : 

LANDING/ SAFING: 

REDUNDANCY SCREENS: 

LOCATION: ORBITER THRUST STRUCTURE 

PART NUMBER: MC621-0015 

CAUSES: SEAL FAILURE IN AND DOWNSTREAM OF SWITCH VALVE 

EFFECTS/ RATIONALE t 

ASCENT - LOSS OF SOME HYDRAULIC FLUID, HOWEVER THERE IS 
INSUFFICIENT TIME TO DEPLETE A POWER SYSTEM - FULL CONTROL 
CAPABILITY IS PROVIDED. 

ENTRY - THERE IS A POSSIBLE LOSS OF AN HYDRAULIC SYSTEM, HOWEVER 
THE REDUNDANT SYSTEM PROVIDES ADEQUATE CONTROL. 


REFERENCES : 


REPORT DATE 11/22/86 


C-4 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE : 

SUBSYSTEM : 
MDAC ID: 


10 / 02/86 
AT VC 
104 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 2/1R 


ITEM: SWITCH VALVE (6) 

FAILURE MODE: FAILS TO TRANSFER SUBSEQUENT TO LOSS OF ACTIVE 

HYDRAULIC SYSTEM 


LEAD ANALYST: R. WILSON 


SUBSYS LEAD: J. RICCIO 


HIERARCHY : 
MAIN ENGINE TVC 
SWITCH VALVE 


BREAKDOWN 
1 ) 

2 ) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


FLIGHT PHASE 
PRELAUNCH : 
LIFTOFF: 
ONORBIT: 
DEORBIT: 
LANDING/ SAFING 

REDUNDANCY SCREENS: 


SERVO ACTUATOR 


CRITICALITIES 
HDW/FUNC 
3/3 
2/1R 
3/3 
2/1R 
: 3/3 

A [ 2 ] 


ABORT 

HDW/FUNC 

RTLS: 

2/1R 

TAL: 

2/1R 

AOA: 

2/1R 

ATO: 

2/1R 

[ P ] 

C [ P ] 


LOCATION: ORBITER THRUST STRUCTURE 

PART NUMBER: MC621-0015 

CAUSES : JAMMED , CONTAMINATION 

EFFECTS /RATIONALE i 

LOSS OF USE OF STANDBY SYSTEM TO GIMBAL ENGINE AND ENGINE WILL 
LOCK-UP' IN LAST POSITION WITH A POSSIBLE ENGINE COLLISION AND 
POSSIBLE LOSS OF MISSION, VEHICLE/CREW (REQUIRES2 FAILURES , LOSS 
OF ACTIVE HYD. SYS. & FAIL TO TRANSFER, 

ALSO CONDITIONS MUST EXIST FOR ENGINE COLLISION) . 


REFERENCES : 


REPORT DATE 11/22/86 


C-5 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM : 
MDAC ID: 


10 / 02/86 
AT VC 
105 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 3/3 


ITEM: EH SERVOVALVE ASSY 

FAILURE MODE: SERVOVALVE FAILURE ONE CHANNEL HARDOVER 

LEAD ANALYST: R. WILSON SUBSYS LEAD: J. RICCIO 

BREAKDOWN HIERARCHY: 

1) MAIN ENGINE TVC SERVO ACTUATOR 

2) EH SERVOVALVE ASSY ( 4EA. ACT) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 

CRI T ICAL ITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS : 

3/3 

LIFTOFF: 

2/1R 

TAL: 

3/3 

ONORBIT : 

3/3 

AOA: 

3/3 

DEORBIT : 

3/3 

ATO: 

3/3 

LANDING/SAFING 

: 3/3 



REDUNDANCY SCREENS: 

A [ 2 ] 

B [ F ] 

C [ P ] 

LOCAT ION: ORB I TER 

THRUST STRUCTURE 



PART NUMBER: MC6 21-00 15 


CAUSES: LOSS OF CMD . SIGNAL, DEFECTIVE TORQUE MOTOR, BLOCKED 

METERING ORIFICE, LOOSE NOZZLE/FLAPPER, BROKEN FEEDBACK WIRE 

EFFECTS /RATIONALE : 

NONE - REMAINING 3 CHANNELS FOR CONTROL (2 CHANNELS CAN OVERRIDE 
1 FAILED CHANNEL) VEHICLE LOSS AFTER 3 FAILURES, HOWEVER THE 
FAULT DETECTION AND ISOLATION RECONFIGURATION FUNCTION IN ATVC 
AVIONICS IS INHIB ITED DUR IN G 1 ST 2-3 S EC. OF ENGINE^ IGNITION 
IF 2ND FAILURE OCCURS DURING TIME PERIOD - THERE IS A POSSIBLE 
LOSS OF CONTROL AND POSSIBLE LOSS OF VEHICLE/CREW. 


REFERENCES : 


REPORT DATE 11/22/86 


C-6 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE : 

SUBSYSTEM : 
MDAC ID: 


10 / 02/86 
AT VC 
106 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 3/3 


ITEM: EH SERVOVALVE ASSY 

FAILURE MODE: SERVOVALVE FAILURE 


LEAD ANALYST: R. WILSON SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) MAIN ENGINE TVC SERVO ACTUATOR 

2) EH SERVOVALVE ASSY ( 4EA . ACT) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT : 
DEORBIT : 
LANDING/ SAFING 

HDW/FUNC 
3/3 
2/1R 
3/3 
3/3 
: 3/3 

ABORT 

RTLS: 

TAL: 

AOA: 

ATO: 

HDW/FUNC 

3/3 

3/3 

3/3 

3/3 

REDUNDANCY SCREENS: 

A [ 2 ] 

B [ F ] 

C [ P ] 


LOCATION: ORBITER THRUST STRUCTURE 

PART NUMBER: MC621-0015 , 

CAUSES: LOSS OF SIGNAL, ELECTRICAL OPEN (ATVC DRIVER FAIL OR 

ERRONEOUS ATVC OUTPUT) DEFECTIVE TORQUE MOTOR, JAMMED SPOOL 

EFFECTS /RATIONALE i 

THERE IS A POSSIBLE LOSS OF CONTROL, HOWEVER TWO FAILURES ARE 
REQUIRED BEFORE A CONTROL PROBLEM EXISTS. IF FAILURE OCCURS 
DURING NULL COMMANDING OR DURING A LOW VARYING RATE, THE ATVC 
DRIVER CANNOT DETECT THE FIRST FAILURE. 

FAILURES DURING DYNAMIC CONDITIONS ARE DETECTABLE. 


REFERENCES : 


REPORT DATE 11/22/86 


C-7 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM : 
MDAC ID: 


10 / 02/86 
AT VC 
107 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM : FILTER 

FAILURE MODE: NO FLOW TO SERVOVALVE 


LEAD ANALYST: R. WILSON 


SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) MAIN ENGINE TVC SERVO ACTUATOR (6) 

2) EH SERVOVALVE ASSY ( 4EA. ACT) 

3) FILTER (1EA ACT. ) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE HDW/FUNC ABORT 

PRELAUNCH: 3/3 RTLS: 

LIFTOFF: 1/1 TAL: 

ONORBIT: 3/3 AOA: 

DEORBIT: 1/1 ATO: 

LANDING/SAFING: 3/3 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 


REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 


LOCATION: ORBITER THRUST STRUCTURE 

PART NUMBER: MC621-0015 . 

CAUSES: FILTER CLOGGED, EXCESSIVE CONTAMINATION 


EFFECTS /RATIONALE i 

THE ACTUATOR FAILS HARDOVER WITH A POSSIBLE ENGINE COLLISION 
WHICH RESULTS IN LOSS OF CONTROL AND LOSS OF VEHICLE CREW. 


REFERENCES : 


REPORT DATE 11/22/86 


C-8 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE : 

SUBSYSTEM: 
MDAC ID: 


10 / 02/86 
AT VC 
108 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT : 3/3 


ITEM : FILTER 

FAILURE MODE: FAILS TO FILTER 


LEAD ANALYST: R. WILSON SUBSYS LEAD: J. RICCIO 


BREAKDOWN 

1 ) 

2 ) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


HIERARCHY : 

MAIN ENGINE TVC SERVO ACTUATOR 
EH SERVOVALVE ASSY ( 4EA . ACT) 
FILTER ( 1EA ACT.) 


( 6 ) 


CRITICALITIES 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF: 
ONORBIT : 
DEORBIT : 
LANDING/SAFING 

HDW/FUNC 
3/3 
3/3 
3/3 
3/3 
: 3/3 

ABORT 
RTLS : 
TAL: 
AOA: 
ATO: 

HDW/FUNC 

3/3 

3/3 

3/3 

3/3 

REDUNDANCY SCREENS: 

A [ 2 ] 

B [ F. ] 

C [ P ] 


LOCATION: ORBITER THRUST STRUCTURE 

PART NUMBER: MC621-0015 


CAUSES : RUPTURED FILTER 

EFFECTS/RATIONALE : 

NONE - 15 MICRON FILTER SIZED FOR VEHICLE LIFE - UPSTREAM 5 
MICRON FILTER POP-UP INDICATOR (GROUND) - WOULD HAVE TO ALLOW 
CONTAMINATION TO JAM ALL 4 SERVO VALVE SPOOLS. FAILURE HIGHLY 
UNLIKELY . 

NO KNOWN CONDITIONS COULD CAUSE THE 15 MICRON FILTER TO RUPTURE. 
NON-CREDIBLE FAILURE. 


REFERENCES : 


REPORT DATE 11/22/86 


C-9 



INDEPENDENT ORB ITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 

DATE: 10/02/86 HIGHEST CRITICALITY HDW/FUNC 

SUBSYSTEM: ATVC FLIGHT: 2/1R 

MDAC ID: 109 ABORT: 3/3 

ITEM: TORQUE MOTOR ASSY 

FAILURE MODE: MOTOR FAILS 

LEAD ANALYST: R. WILSON SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) MAIN ENGINE TVC SERVO ACTUATOR 

2) EH SERVOVALVE ASSY ( 4EA. ACT) 

3) TORQUE MOTAR ASSY 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


( 6 ) 


CRITICALITIES 


FLIGHT PHASE HDW/FUNC ABORT 

PRELAUNCH: 3/3 RTLS: 

LIFTOFF: 2/1R TAL: 

ONORBIT: 3/3 AOA: 

DEORBIT: 3/3 ATO: 

LANDING/SAFING: 3/3 


HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [ 2 ] B[F] C[P] 

LOCATION: ORBITER THRUST STRUCTURE 

PART NUMBER: MC6 21-00 15 


CAUSES: OPEN, SHORT IN MOTOR WINDINGS, LOSS OF SIGNAL FROM ATVC. 


EFFECTS /RATIONALE i 

LOSS OF 1 OF 4 CHANNELS. FAILURE IS 3/1R, HOWEVER, 2ND ATVC 
FAILURE CAN CAUSE LOSS OF CONTROL IF UNDETECTED THEREFORE ATVC 
FAILURE MODE IS 2/1R. (SEE MDAC ID 105 & 106) 


REFERENCES : 


REPORT DATE 11/22/86 


C-10 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE : 

SUBSYSTEM : 
MDAC ID: 


10 / 02/86 

ATVC 

110 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT : 3/3 


ITEM: TORQUE MOTAR ASSY 

FAILURE MODE: FLAPPER FAILS TO CLOSE OFF ORIFICE TO DIRECT HYD. 

PRESS. TO SERVOVALVE 


LEAD ANALYST: R. WILSON SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) MAIN ENGINE TVC SERVO ACTUATOR (6) 

2) EH SERVOVALVE ASSY ( 4EA. ACT) 

3) TORQUE MOTAR ASSY 

4) 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS : 

3/3 

LIFTOFF: 

2/1R 

TAL: 

3/3 

ONORBIT : 

3/3 

AOA: 

3/3 

DEORBIT : 
LANDING/SAFING 

3/3 
: 3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [ 2 ] 

B [ F ] 

C [ P ] 


LOCATION: ORBITER THRUST STRUCTURE 

PART NUMBER: MC621-0015 


CAUSES: FLAPPER JAMMED, BROKEN (FATIGUE) 

EFFECTS /RATIONALE : 

LOSS OF 1 OF 4 CHANNELS. (SEE MDAC ID 106) 


REFERENCES : 


REPORT DATE 11/22/86 


C-ll 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM: 
MDAC ID: 


10 / 02/86 
AT VC 
111 


HIGHEST CRITICALITY 
FLIGHT : 
ABORT: 


HDW/FUNC 

1/1 

3/3 


ITEM: MECHANICAL POSITION FEEDBACK SPRING CAGE ASSY 

FAILURE MODE: NO POSITION FEEDBACK 


LEAD ANALYST: R. WILSON SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) METVC SERVO ACTUATOR 

2) EH SERVOVALVE ASSY 

3) MECH. POS. FDBK - SPRING CAGE ASSY 

4) 

5) 

6 ) 

7) 

8) 

9) 


CRITICALITIES 


FLIGHT PHASE HDW/FUNC ABORT 

PRELAUNCH : 3/3 RTLS : 

LIFTOFF: 1/1 TAL: 

ONORBIT: 3/3 AOA: 

DEORBIT: 3/3 ATO: 

LANDING/SAFING: 3/3 


HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [NA ] B [NA ] 


C [NA ] 


LOCATION: ORBITER THRUST STRUCTURE 

PART NUMBER: MC621-0015 


CAUSES: FEEDBACK MECHANISM JAMMED OR SEPARATED 

EFFECTS /RATIONALE i 

ASCENT - ACTUATOR FAILS HARD OVER WITH A POSSIBLE ENGINE 
COLLISION AND LOSS OF CONTROL. ORBIT - NO EFFECT, SYSTEM IS 
ISOLATED, REAMINING SYSTEM PROVIDES ENGINE POSITIONING 
CAPABILITY . 

ENTRY - NONE, ADEQUATE ENGINE POSITIONING. 


REFERENCES : 


REPORT DATE 11/22/86 


C-12 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE : 

SUBSYSTEM : 
MDAC ID: 


10 / 02/86 
AT VC 
112 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/1R 

ABORT: 3/3 


ITEM: BYPASS VALVE 

FAILURE MODE: VALVE FAILS TO ISOLATE FAILED SERVOVALVE 


LEAD ANALYST: R. WILSON 


SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY; 


1) 

2 ) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 
9 ) 


METVC SERVO ACTUATOR 
EH SERVOVALVE ASSY ( 4EA ACT) 
BYPASS VALVE ( 4EA ACT) 


CRITICALITIES 


FLIGHT PHASE 
PRELAUNCH: 
LIFTOFF : 
ONORBIT: 
DEORBIT : 
LANDING/ SAFING 

HDW/FUNC 
3/3 
3/1R 
3/3 
3/3 
: 3/3 

ABORT 
RTLS : 
TAL: 
AOA: 
ATO: 

HDW/FUNC 

3/3 

3/3 

3/3 

3/3 

REDUNDANCY SCREENS: 

A [ 2 ] 

B [ P ] 

C [ P ] 


LOCATION: ORBITER THRUST STRUCTURE 

PART NUMBER: MC621-0015 


CAUSES: JAMMED SPOOL, ELECTRICAL OPEN TO SOLENOID, LOSS OF ATVC 

DRIVE, ERRONEOUS ATVC OUTPUT 

EFFECTS /RATIONALE i 

LOSS OF ISOLATION OF DEFECTIVE CHANNEL - 4 FAILURES ARE REQUIRED 
BEFORE A CONTROL PROBLEM EXISTS (2 SERVOVALVES HARD OVER AND 2 
RELATED ISO VLV OPEN) . 


REFERENCES : 


REPORT DATE 11/22/86 


C-l 3 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE : 

SUBSYSTEM : 
MDAC ID: 


10 / 02/86 
AT VC 
113 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 2/1R 

ABORT: 3/3 


ITEM: SECONDARY DELTA- P TRANSDUCER 

FAILURE MODE: FAILS TO SENSE DELTA-P 


LEAD ANALYST: R. WILSON 


SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) METVC SERVO VALVE 

2) EH SERVOVALVE ASSY 

3) SEC. DELTA-P X-DUCER 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE HDW/FUNC ABORT 

PRELAUNCH : 3/3 RTLS : 

LIFTOFF: 2/1R TAL: 

ONORBIT: 3/3 AOA: 

DEORBIT: 3/3 ATO: 

LANDING/SAFING: 3/3 


HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [ 2 ] 


B [ F ] 


C [ P ] 


LOCATION: ORBITER THRUST STRUCTURE 

PART NUMBER: MC621-0015 

CAUSES: DEFECTIVE LVDT, ELECTRICAL OPEN, LOSS OR ERRONEOUS 

OUTPUT ATVC, JAMMED PISTON 


EFFECTS /RATIONALE : 

LOSS OF ISOLATION OF DEFECTIVE C HANN EL. LOSS OF CONTROL WITH 
LOSS OF VEHICLE/CREW REQUIRES FOUR FAILURES (2 SERVOVALVES 
HARDOVER PLUS 2 DELTA-P TRANSDUCERS FAIL). 

IF A FAILURE OCCURS DURING NULL COMMANDS OR AT A LOW VARYING 
RATE, THE AT VC DRIVER CANNOT DETECT FAILURE, THEREFORE A 
SUBSEQUENT FAILURE DURING DYNAMIC CONDITIONS WOULD LEAVE 2 
CHANNELS OPERATIONAL. 

HOWEVER, THE ASA CANNOT ISOLATE WHICH OF THE LAST TWO CHANNELS 
FAILED. THIS WOULD RESULT IN LOSS OF CONTROL. 


REFERENCES : 


REPORT DATE 11/22/86 


C-14 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 



DATE: 

10/02/86 

HIGHEST CRITICALITY 

HDW/FUNC 


SUBSYSTEM : 

AT VC 

FLIGHT : 

1/1 

= ■ 

MDAC ID: 

114 

ABORT: 

1/1 

— - 

ITEM: 

POWER SPOOL 

VALVE ASSY 



FAILURE MODE 

: POWER VALVE 

SPOOOL JAMMED 



LEAD ANALYST 

: R. WILSON 

SUBSYS LEAD: J. RICCIO 



BREAKDOWN HIERARCHY: 

1) METVC SERVO VALVE 

2) POWER SPOOL VALVE ASSY ( 1EA ACT) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 



FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 


PRELAUNCH: 

3/3 

RTLS: 

1/1 

« . 

LIFTOFF : 

1/1 

TAL: 

1/1 

E;=3 

ONORBIT : 

3/3 

AOA: 

1/1 


DEORBIT : 

1/1 

ATO: 

1/1 


LANDING/ SAFING: 

3/3 



§ 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: ORBITER THRUST STRUCTURE 

PART NUMBER: MC621-0015 


CAUSES : CONTAMINATION 

EFFECTS /RATIONALE z 

ACTUATOR FAILS HARDOVER RESULTING IN A POSSIBLE ENGINE COLLISION 
AND LOSS OF CONTROL WHICH RESULTS IN LOSS OF VEHICLE/CREW. 

ASCENT - ABORT DECISION 



REFERENCES : 


REPORT DATE 11/22/86 


C-15 


INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE : 

SUBSYSTEM : 
MDAC ID: 


10 / 02/86 
AT VC 
115 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: CHECK VALVE 

FAILURE MODE: FAILS CLOSED 

LEAD ANALYST: R. WILSON SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 


1 ) 

2 ) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 
9) 


METVC 

POWER 

CHECK 


SERVO 

SPOOL 

VALVE 


ACT (6) 
VALVE ASSY 


( 1EA ACT) 


CRITICALITIES 


FLIGHT PHASE HDW/FUNC ABORT 

PRELAUNCH: 3/3 RTLS : 

LIFTOFF: 1/1 TAL: 

ONORBIT: 3/3 AOA: 

DEORBIT: 1/1 ATO: 

LANDING/SAFING: 3/3 


HDW/FUNC 

1/1 

1/1 

1/1 

1/1 


REDUNDANCY SCREENS: A [NA ] B [NA ] 


C [NA ] 


LOCATION: ORBITER THRUST STRUCTURE _ 

PART NUMBER: MC621-0015 


CAUSES: JAMMED, CONTAMINATION 

EFFECTS /RATIONALE • 

LOSS OF PRESSURE TO POWER SPOOL VALVE RESULTS IN LOSS OF CONTROL 
OF ONE ENGINE WITH A POSSIBLE ENGINE COLLISION RESULTING. THIS 
RESULTS IN LOSS OF CONTROL AND POSSIBLE INTERFERENCE WITH BODY 
FLAP DURING ENTRY. 

ASCENT - ABORT UNLESS ORBIT CAN BE ACHIEVED. 


REFERENCES : 


REPORT DATE 11/22/86 


C-16 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


HDW/FUNC 

3/3 

3/3 


BREAKDOWN HIERARCHY: 


1 . _ 

i) 

MET VC SERVO ACT (6) 




2) 

POWER SPOOL VALVE ASSY ( 1EA 

ACT) 



3) 

CHECK VALVE 




4) 




— 

5) 





6) 




§ : 

7) 




- 

8 ) 





9) 






CRITICALITIES 




FLIGHT PHASE HDW/FUNC 

ABORT 

HDW/FUNC 



PRELAUNCH: 3/3 

RTLS: 

3/3 



LIFTOFF: 3/3 

TAL: 

3/3 



ONORBIT: 3/3 

AOA: 

3/3 



DEORBIT: 3/3 

ATO: 

3/3 



LANDING/SAFING : 3/3 



i 

REDUNDANCY SCREENS: A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: ORBITER THRUST STRUCTURE 

PART NUMBER: MC621-0015 


CAUSES: JAMMED, CONTAMINATION 

EFFECTS /RATIONALE : 

NONE. WITH A NORMAL SYSTEM THERE IS ONLY A SLOWLY DECREASING 
PRESSURE LOSS. C&W LIGHT IS ACTIVATED AT 2750 +100 PSI WHICH IS 
SUFFICIENT TO MAINTAIN ACTUATOR POSITION C&W LIGHT ON. PILOT 
ACTION/DECISION TO DEACTIVATE FAILING SYSTEM. AUTO-SWITCH TO 
REDUNDANT SYSTEM. THIS FAILURE MODE IS NON FUNCTIONALLY 
CRITICAL. 


DATE : 

SUBSYSTEM: 
MDAC ID: 


10 / 02/86 
AT VC 
116 


HIGHEST CRITICALITY 
FLIGHT : 
ABORT: 


ITEM: 

FAILURE MODE: 


CHECK VALVE 
FAILS OPEN 


LEAD ANALYST: R. WILSON 


SUBSYS LEAD: J. RICCIO 


REFERENCES : 


REPORT DATE 11/22/86 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM : 
MDAC ID: 


10 / 02/86 
AT VC 
117 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM : LOCK VALVE 

FAILURE MODE: FAILS IN CLOSED POSITION 


LEAD ANALYST: R. WILSON SUBSYS LEAD: J. RICCIO 

BREAKDOWN HIERARCHY: 


1) 

METVC SERVO 

ACT 

(6) 



2) 

POWER SPOOL 

VALVE ASSY ( 1EA ACT) 



3) 

LOCK VALVE 





4) 






5) 






6) 






7) 






8) 






9) 









CRITICALITIES 



FLIGHT PHASE 


HDW/FUNC 

ABORT 

HDW/FUNC 


PRELAUNCH 

* 

3/3 

RTLS: 

1/1 


LIFTOFF: 


3/3 

TAL: 

1/1 


ONORBIT : 


3/3 

AOA: 

1/1 


DEORBIT: 


1/1 

ATO: 

1/1 


LANDING/ SAFING 

: 3/3 




REDUNDANCY SCREENS: A [NA ] B [NA ] C [NA ] 

LOCATION: ORBITER THRUST STRUCTURE 

PART NUMBER: MC621-0015 


CAUSES: JAMMED, SPOOL CONTAMINATION, BROKEN SPRING 

EFFECTS /RATIONALE : 

ASCENT - NO EFFECT-VLV IS VERIFIED OPEN IN PRE-LAUNCH BY PROPER 
SYS TEM FUNC TION. DO- POSSI BLE LOSS OF MISS IO N, CREW, VEHICLE DUE 
TO RESULTING CONTROL PROBLEM DEPENDING ON ENGINE POSITION . 

THERE IS A POSSIBLE LOSS OF CAPABILITY TO POSITION ENGINE FOR 
ENTRY. . ... ....... 


REFERENCES : 


REPORT DATE 11/22/86 


C-18 


independent orbiter assessment 

ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM : 
MDAC ID: 


10 / 02/86 
AT VC 
118 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: LOCK VALVE 

FAILURE MODE: FAILS IN OPEN POSITION 


LEAD ANALYST: R. WILSON SUBSYS LEAD: J. RICCIO 

BREAKDOWN HIERARCHY: 

1) METVC SERVO ACT (6) 

2) POWER SPOOL VALVE ASSY ( 1EA ACT) 

3 ) LOCK VALVE 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS : 

1/1 

LIFTOFF: 

3/3 

TAL: 

1/1 

ONORBIT : 

3/3 

AOA: 

1/1 

DEORBIT : 

1/1 

ATO: 

1/1 

LANDING/SAFING 

: 3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ]■ 


LOCATION: - ORBITER THRUST STRUCTURE 

PART NUMBER: MC621-0015 


CAUSES: JAMMED SPOOL, BROKEN SPRING SEAL FAILURE. INTERNAL 

LEAKAGE (PAST PISTON SEAL) EXTERNAL LEAKAGE (PAST PISTON ROD 
SEAL) 

EFFECTS /RAT ION ALE i 

ASCENT - NOT APPLICABLE, VALVE IS NORMALLY OPEN AND ACTUATOR IS 
IN A DYNAMIC MODE WHICH COMPENSATES FOR LEAKAGE. 

DEORBIT - POSSIBLE LOSS OF MISSION, VEHICLE, CREW. FAILURE COULD 
POSSIBLY LEAVE ENGINE IN POSITION TO INTERFERE WITH BODY FLAP. 
UPPER ENGINE WOULD PROJECT INTO AIR STREAM RESULTING IN A 
POSSIBLE CONTROL PROBLEM. 


REFERENCES : 


REPORT DATE 11/22/86 


C-19 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM : 
MDAC ID: 


10 / 02/86 
AT VC 
119 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: FORCE LIMITER VALVE 

FAILURE MODE: VALVE FAILS TO CLOSE 


LEAD ANALYST: R. WILSON 


SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 


1 ) 

2 ) 

3 ) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


METVC SERVO ACT (6) 
POWER SPOOL VALVE ASSY 
FORCE LIMITER VALVE 


( 1EA ACT) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

PRELAUNCH: 

3/3 

RTLS: 

LIFTOFF: 

3/3 

TAL: 

ONORBIT: 

3/3 

AOA: 

DEORBIT: 

3/3 

ATO: 

LANDING/ SAFING 

: 3/3 



HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [NA ] B [NA ] 


C [NA ] 


LOCATION: ORBITER THRUST STRUCTURE 

PART NUMBER: MC621-0015 


CAUSES: JAMMED, CONTAMINATION, BROKEN S PR ING 


EFFECTS /RATIONALE • 

NONE - ADEQUATE CONTROL CAPABILITY EXISTS. THIS FAILURE IS 
FUNCTIONALLY NON-CRITICAL SINCE AN OPEN VALVE WOULD NOT DEGRADE 
ACTUATOR PERFORMANCE. CONDITIONS MUST EXIST TO CAUSE VALVE TO 
OPEN ARE NON-CREDIBLE . 

NOTE: DESIGNED TO LIMIT CYLINDER PRESSURE TO 4050 PSIA. VALVE 
WAS INSTRUMENTED DURING OFT PROGRAM, HAS SINCE BEEN REMOVED FROM 
ORBITER. (SERVO ACTUATOR DESIGNED TO 9000 PSIA, ATP TO 4500 
PSIA) . 


REFERENCES : 


REPORT DATE 11/22/86 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM : 
MDAC ID: 


10 / 02/86 
AT VC 
120 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT : 3/3 


ITEM : FORCE LIMITER VALVE 

FAILURE MODE: VALVE FAILS TO OPEN 

LEAD ANALYST: R. WILSON SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 


H 

i) 

METVC 

SERVO ACT (6) 


2) 

POWER 

SPOOL VALVE ASSY 


3) 

FORCE 

LIMITER VALVE 


4) 



— 

5) 




6) 




1 ) 




8) 




9) 




( 1EA ACT) 


CRITICALITIES 


FLIGHT PHASE HDW/FUNC ABORT 

PRELAUNCH: 3/3 RTLS: 

LIFTOFF: 3/3 TAL: 

ONORBIT: 3/3 AOA: 

DEORBIT: 3/3 ATO: 

LANDING/SAFING: 3/3 


HDW/FUNC 

3/3 

3/3 

3/3 

3/3 


REDUNDANCY SCREENS: A [NA ] B [NA ] 


C [NA ] 


LOCATION: ORBITER THRUST STRUCTURE 

PART NUMBER: MC621-0015 

CAUSES: JAMMED, CONTAMINATION, EXCESSIVE SPOOL SLEEVE FRICTION, 

BROKEN SPRING 

EFFECTS /RATIONALE : 

ASCENT - NONE, VALVE IS NOT REQUIRED TO FUNCTION DURING MAIN 
ENGINE BURNS. OFT FLIGHT DATA SHOWED ACTUATOR SIDE LOADS ARE 
WELL BELOW ATTACH POINT LIMITS AND LOAD RELIEF VALVE IS NOT 
ACTIVATED UNDER THESE CONDITIONS. 


REFERENCES : 


REPORT DATE 11/22/86 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM : 
MDAC ID: 


10 / 02/86 
AT VC 
121 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 1/1 

ABORT: 1/1 


ITEM: CYLINDER AND RAM/PISTON ASS'Y 

FAILURE MODE: FRACTURE OF TAIL STOCK (THRUST, STRUCTURE), PISTON 

ROD END (ENGINE), PISTON HEAD, PISTON ROD 


LEAD ANALYST: R. WILSON SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) METVC SERVO ACT (6) 

2) CYLINDER AND RAM/PISTON ASSY. (LEA. ACT.) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

1/1 

LIFTOFF: 

1/1 

TAL: 

1/1 

ONORBIT: 

3/3 

AOA: 

1/1 

DEORBIT : 

1/1 

ATO: 

1/1 

LANDING/ SAFING 

: 3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: ORBITER THRUST STRUCTURE 

PART NUMBER: MC6 21-00 15 


CAUSES: MATERIAL DEFECT ,' FATIGUE 

EFFECTS /RATIONALE : 

ASCEN T - LOSS OF ENGINE GIMBAL CON TROL. • _ 

ENTRY - LOSS OF ABILITY TO MAINTAIN ENGINE POSITION CAN RESULT IN 
POSSIBLE ENGINE COLLISION. ENGINE CAN PROJECT INTO AIRSTREAM OR 
INTERFERE WITH BODY FLAP WHICH RESULTS IN POSSIBLE LOSS OF 
CONTROL . 


REFERENCES : 


REPORT DATE 11/22/86 


C-22 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE : 

SUBSYSTEM : 
MDAC ID: 


10 / 02/86 

ATVC 

122 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: DYNAMIC PRESSURE FEEDBACK VALVE 

FAILURE MODE: SPOOL FAILS TO SHUTTLE 


LEAD ANALYST: R. WILSON 


SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) METVC SERVO ACT (6 

2) EH SERVO VALVE ASSY. (4 EA. ACT.) 

3) DYNAMIC PRESSURE FDBK . VLV. (4 EA. 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


ACT. ) 


CRITICALITIES 


Flight phase 

PRELAUNCH: 
LIFTOFF: 
ONORBIT : 
DEORBIT : 
LANDING/ SAFING 

HDW/FUNC 
3/3 
3/3 
3/3 
3/3 
: 3/3 

ABORT 

RTLS: 

TAL: 

AOA: 

ATO: 

HDW/FUNC 

3/3 

3/3 

3/3 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: ORBITER THRUST STRUCTURE 

PART NUMBER: MC621-0015 


CAUSES: CONTAMINATION, BROKEN SPRING JAMS SPOOL 

EFFECTS /RATIONALE : 

NO EFFECT-OTHER 3 VALVES WOULD RESPOND TO PRESSURE FLUCTUATIONS 
RESULTING FROM ME VIBRATIONS CAUSING ACTUATOR MAIN PISTON/RAM TO 
SLIGHTLY EXTEND ¥6 RETRACT J 

LOSS OF 1 OR ALL IF THE DYNAMIC FEEDBACK VALVES HAS NO EFFECT ON 
CONTROLLABILITY OF THE ME SERVO ACTUATORS. THIS FAILURE IS 
FUNCTIONALLY NON-CRITICAL . 


REFERENCES : 


REPORT DATE 11/22/86 


C-23 



INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

SUBSYSTEM : 
MDAC ID: 


10 / 02/86 
AT VC 
123 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT: 3/3 


ITEM: DYNAMIC PRESSURE FEEDBACK VALVE 

FAILURE MODE: SPOOL FAILS TO RETURN TO NULL 


LEAD ANALYST: R. WILSON SUBSYS LEAD: J. RICCIO 


BREAKDOWN HIERARCHY: 

1) METVC SERVO ACT (6) 

2) EH SERVO VALVE ASSY. (4 EA. 

3) DYNAMIC PRESSURE FDBK . VLV. 

4) 

5) 

6 ) 

7) 

8 ) 

9) 


ACT. ) 

(4 EA. ACT. ) 


CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS : 

3/3 

LIFTOFF : 

3/3 

TAL: 

3/3 

ONORBIT : 

3/3 

AOA: 

3/3 

DEORBIT : 
LANDING/ SAFING 

3/3 
: 3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: ORBITER THRUST STRUCTURE 

PART NUMBER: MC621-0015 


CAUSES: CONTAMINATION, BROKEN SPRING JAMS SPOOL 

EFFECTS /RAT I ON ALE i 

NO EFFECT-OTHER 3 VALVES WOULD PREVENT UNWANTED MOVEMENT OF POWER 
SPOOL DUE TO PRESSURE FROM FAILED DYNAMIC FEEDBACK VALVE. 

LOSS OF 1 OR ALL OF THE VALVES HAS NO EFFECT ON CONTROLAB I L I T Y OF 
THE ACTUATORS. THIS FAILURE IS FUNCTIONALLY NON-CRITICAL . 


REFERENCES : 


REPORT DATE 11/22/86 
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INDEPENDENT ORBITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE: 

10/02/86 

HIGHEST CRITICALITY 

HDW/FUNC 

SUBSYSTEM : 

AT VC 

FLIGHT : 

3/3 

MDAC ID: 

124 

ABORT : 

3/3 

ITEM: 

FLOW CUTOFF 

VALVE 


FAILURE MODE 

: FAILS OPEN 



LEAD ANALYST 

: R. WILSON 

SUBSYS LEAD: J. RICCIO 



BREAKDOWN HIERARCHY: 

1) METVC SERVO ACT (6) 

2 ) FLOWCUTOFF VALVES (1 EA . ACT . ) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT: 

3/3 

AOA: 

3/3 

DEORBIT : 

3/3 

ATO: 

3/3 

LANDING/SAFING 

: 3/3 



REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: ORBITER THRUST STRUCTURE 

PART NUMBER: MC621-0015 


CAUSES: CONTAMINATION POPPET JAMMED 

EFFECTS /RATIONALE : 

VALVE IS UPSTREAM OF STANDBY HYDRAULIC LINE TO SWITCHING VALVE. 
VALVE IS CLOSED WITH PRESSURE ABOVE 350-PSIG AND IS USED TO 
CIRCULATE (WARM) HYD. FLUID IN STANDBY LINE. ASCENT - MINOR LOSS 
OF SYSTEM POWER AVAILABLE DUE TO BYPASSING 

FLUID. HAS ESSENTIALLY NO EFFECT ON SYSTEM OPERATION. DEORBIT - 
NO EFFECT. TVC ISO VALVES ARE CLOSED EXCEPT FOR PERIOD OF ENGINE 
REPOSITIONING. THIS FAILURE IS FUNCTIONALLY NON-CRITICAL . 


REFERENCES : 


REPORT DATE 11/22/86 
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INDEPENDENT ORB ITER ASSESSMENT 
ORBITER SUBSYSTEM ANALYSIS WORKSHEET 


DATE : 

SUBSYSTEM : 
MDAC ID: 


10 / 02/86 
AT VC 
125 


HIGHEST CRITICALITY HDW/FUNC 
FLIGHT: 3/3 

ABORT : 3/3 


ITEM: FLOW CUTOFF VALVE 

FAILURE MODE: FAILS CLOSED 

LEAD ANALYST: R. WILSON SUBSYS LEAD: J.. RICCIO 


BREAKDOWN HIERARCHY: 

1 ) METVC SERVO' ACT ( 6 ) 

2 ) FLOWCUTOFF VALVES (1 EA . ACT . ) 

3) 

4) 

5) 

6 ) 

7) 

8 ) 

9) 

CRITICALITIES 


FLIGHT PHASE 

HDW/FUNC 

ABORT 

HDW/FUNC 

PRELAUNCH: 

3/3 

RTLS: 

3/3 

LIFTOFF: 

3/3 

TAL: 

3/3 

ONORBIT : 

3/3 

AOA: 

3/3 

DEORBIT : 
LANDING/ SAFING: 

3/3 

3/3 

ATO: 

3/3 

REDUNDANCY SCREENS: 

A [NA ] 

B [NA ] 

C [NA ] 


LOCATION: ORBITER THRUST STRUCTURE 

PART NUMBER: MC621-0015 

CAUSES: CONTAMINATION POPPED JAMMED FRACTURES SPRING 


EFFECTS /RATIONALE : 

THE VALVE IS OPEN DURING LOW PRESSURE OPERATION ONLY. THERE IS A 
LOSS OF SYSTEM CAPABILITY TO THERMALLY CONDITION STANDY HYD. 
SYSTEM AT AFFECTED ACTUATOR. THERE IS NO EFFECT SINCE STDBY 
SYSTEM WILL FUNCTION NORMALLY ONCE IT IS FUNCTIONING AS 
THE PRIMARY SOURCE. THE FAILURE EFFECT IS TEMPORARY AND NON- 
CRITICAL . DEORBIT - NO EFFECT. TVC ISO VALVES ARE CLOSED EXCEPT 
DURING ENGINE REPOSITIONING. NOTE : VALVE OPERATES ONLY WHEN 2 
CIRCULATION PUMPS ARE RUNNING IN PRE-LAUNCH AND POST-LANDING. 


REFERENCES : 


REPORT DATE 11/22/86 
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APPENDIX D 

POTENTIAL CRITICAL ITEMS 


MDAC ID 

ITEM 

101 

METVC Servoactuator 

102 

METVC Servoactuator 

103 

METVC Servoactuator 

104 

Switch Valve 

105 

E-H Servovalve 

106 

E-H Servovalve 

107 

Filter 

109 

Torque Motor Ass'y. 

110 

Torque Motor Ass'y. 

111 

Mechanical Position 
Feedback Spring Cage 
Assembly 

113 

Secondary Delta P 
Transducer 

114 

Power Spool 

115 

Check Valve 

117 

Lock Valve 

118 

Lock Valve 

121 

Cylinder and Ram/ 
Piston Assembly 


FAILURE MODE 

Component rupture downstream 

of switch valve 

External leakage 

Internal leakage 

Fails to transfer 

Fail one channel hardover 

One channel fail 

No flow to servovalve 

Motor fails 

Flapper fails 


No position feedback 

Fail to service Delta P 
Jammed 

Fails closed 
Fails closed 
Fails open 

Fracture 


D-l 



